19,727 reputation
12779
bio website
location Paris, France
age
visits member for 3 years
seen 1 hour ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Jul
15
accepted Which version(s) of SRP are in ISO/IEC 11770-4:2006?
Jul
15
comment Attack on DSA modification with bad hash function
Does the statement allow the attacker to choose $m$ or/and $m'$? With what constraints?
Jul
10
revised Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
Remove excess Woods
Jul
9
comment How can I calculate the Rijndael SBox?
Some links: A new combinational logic minimization technique with applications to cryptology by Joan Boyar and René Peralta; this code-challenge; this code-golf; and this implementation.
Jul
9
comment Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
@CodesInChaos: Very right! I fixed the answer according to your observation.
Jul
9
revised Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
Revise per comment
Jul
9
comment RSA-based authentication and key-agreement protocol
In the tiny subset of Java available in Java Card Classic, any portable code doing a computation on big numbers that is not natively implemented by the API incurs a performance hit by a factor of 50 or more compared to a native implementation; even addition over more than 16 bits is nontrivial (support of the 32-bit int type at runtime is an option not available on most cards!); further, the risk of side-channel attack exists.
Jul
9
comment Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
As rightly pointed by CodesInChaos, Merkle-Damgård hashes are not second-preimage-resistant to $2^n$ effort (see John Kelsey and Bruce Schneier's Second Preimages on $n$-bit Hash Functions for Much Less than $2^n$ Work), so it would seem that the proposed construction does NOT weaken SHA-256 after all.
Jul
9
revised Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
Generalize to any number of separately hashed blocks; use TeX
Jul
9
comment Client authentication on limited hardware
RSA is very fast for the purpose of authenticating something (rather than: authenticate w.r.t. something). For 2048-bit public modulus, public exponent $e=3$, and a CPU with 32x32 bit multiplication, in the order of 17000 multiply-and-accumulate are enough, with textbook algorithms and straightforward loops. This can be about halved with Rabin, while still having standard-conformance, e.g to ISO/IEC 9796-2, and then there's DjB's work.
Jul
9
revised Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
Fix typos
Jul
9
comment RSA-based authentication and key-agreement protocol
Ah, right, I did not read up to the KGC-free certificate-based variant (page 24), sorry about that; I do see it now, thanks for your patience! $\;$ Still, the public-key certificates need more parameters than in RSA, and it seems non-trivial to implement the protocol on top of RSA primitives: I think we need modular squaring and/or inverse, and either is a nightmare to implement in the subset of Java available in a Java Card Classic Smart Card.
Jul
8
revised How is this affine function a pair wise independent permutation?
Polish
Jul
8
revised How is this affine function a pair wise independent permutation?
Add missing step
Jul
8
revised How is this affine function a pair wise independent permutation?
Polish and simplify
Jul
8
revised How is this affine function a pair wise independent permutation?
Shorten
Jul
8
revised How is this affine function a pair wise independent permutation?
I'm more confortable with a finite field after all.
Jul
8
revised How is this affine function a pair wise independent permutation?
Polish
Jul
8
answered How is this affine function a pair wise independent permutation?
Jul
8
revised How is this affine function a pair wise independent permutation?
Added definition requested